CVE-2025-10001: falha de alta gravidade em wpallimport WP All Import – Drag & Drop Import…
Import any XML, CSV or Excel File to WordPress <= 3.9.3 - Authenticated (Admin+) Limited Unsafe File Upload
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.2epss 0.6%
The Import any XML, CSV or Excel File to WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import functionality in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload unsafe files like .phar files on the affected site's server which may make remote code execution possible.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
wpallimport · WP All Import – Drag & Drop Import for CSV, XML, Excel & Google SheetsCVEs relacionadas — wpallimport WP All Import – Drag & Drop Import…
No mesmo produto, das mais perigosas para as menos.
CVE-2022-1565HIGHImport any XML or CSV File to WordPress <= 3.6.7 - Admin+ Malicious File UploadEPSS 15.2%CVE-2025-12733HIGHImport any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional LogicEPSS 0.7%CVE-2026-2830MEDIUMWP All Import <= 4.0.0 - Reflected Cross-Site Scripting via 'filepath'EPSS 0.3%